MoCRA Safety Substantiation: What Cosmetic Brands Must Have on File Before FDA Inspects

Three years after MoCRA was signed into law, a surprising number of cosmetic brands still don’t have a safety substantiation file that would survive an FDA review. That’s not speculation — it’s what we see regularly when brands come to us after receiving an adverse event inquiry or a request for safety records they weren’t expecting. The Modernization of Cosmetics Regulation Act of 2022 fundamentally changed what FDA can demand from cosmetic companies, and the enforcement phase is no longer theoretical.

What follows is a practical look at what “adequate substantiation” actually requires under MoCRA, what a defensible safety file contains, and how working with an accredited cosmetic testing laboratory translates directly into audit-ready documentation.

What MoCRA’s Safety Substantiation Requirement Actually Says

MoCRA was signed on December 29, 2022 as part of the Consolidated Appropriations Act, making it the most significant overhaul of US cosmetic law since the Federal Food, Drug, and Cosmetic Act of 1938. That gap — 84 years — meant the previous statute gave FDA remarkably limited authority over cosmetics. No mandatory registration. No recall authority. No required pre-market safety testing. Brands operated largely on a self-regulatory honor system.

MoCRA ended that arrangement. Among its most consequential provisions, the law places the burden on the “responsible person” — the brand, manufacturer, or importer — to ensure “adequate substantiation” that each cosmetic product is safe. Safe means not causing harm under customary or reasonably foreseeable conditions of use. FDA has not yet published a prescriptive list of exactly what testing must be done to satisfy this standard. That flexibility sounds favorable until you realize it means the bar is whatever FDA considers “adequate” when it pulls your file.

And FDA can pull that file. Under MoCRA, the agency can now request access to your safety documentation when it has reason to believe a cosmetic is adulterated or misbranded. That demand comes with a tight response window — not weeks, a matter of days. If you’re assembling a safety file reactively at that point, you’re already in a difficult position.

Two other requirements that are already fully in effect: facility registration became mandatory by December 29, 2023 for all cosmetic manufacturers and processors with US sales, both domestic and foreign. Product listing — submitting product names and ingredient declarations to FDA — is also now required. And Serious Adverse Event Reporting (SAER) requires responsible persons to submit reports to FDA within 15 business days of receiving a serious adverse event report from a consumer or healthcare professional. A serious adverse event is defined broadly: hospitalization, emergency room treatment, physician intervention, disfigurement, or significant disability.

Brands that haven’t registered or that aren’t tracking adverse events properly are already out of compliance. The more nuanced and costly gap, though, is the safety substantiation file itself.

The Four Testing Pillars of a Defensible Safety File

FDA has not published a final checklist for safety substantiation. A proposed GMP rule is in the pipeline and formal guidance on substantiation is expected to follow. In the interim, the practical standard is informed by three sources: the EU Cosmetics Regulation 1223/2009 (which requires structured safety assessments and is the global benchmark), PCPC industry guidelines, and FDA’s existing cosmetic safety frameworks and enforcement history.

Based on that picture, here’s what analytically defensible substantiation looks like.

Stability Testing

A formula that tests clean at launch may be a degraded, pH-shifted, or preservative-depleted product after 18 months on a warm retail shelf. Accelerated stability studies — typically run at 40°C and 75% relative humidity over 90 days to simulate roughly 24 months of real-time aging — generate quantitative data on pH drift, viscosity changes, color, odor, emulsion separation, and active ingredient concentration. Real-time studies at ambient conditions over 12–24 months complement this. Without stability data covering the claimed shelf life, you can’t assert that the product is safe across its entire market life. That’s a gap FDA reviewers and plaintiff attorneys both notice.

Microbial Testing

USP <61> (Microbiological Examination of Nonsterile Products: Microbial Enumeration Tests) and USP <62> (Tests for Specified Organisms) are the standard methods for establishing total aerobic microbial count (TAMC), total combined yeast and mold count (TYMC), and detection of specified pathogens like Staphylococcus aureus, Pseudomonas aeruginosa, and Candida albicans. Acceptance criteria vary by product type. For eye-area cosmetics, a TAMC of no more than 100 CFU/g is the typical target. For other leave-on products, 1,000 CFU/g is widely used as the upper limit. Rinse-off products allow somewhat higher counts.

Testing at manufacture is the minimum. Testing at multiple stability time points — initial, mid-point, end-of-shelf-life — builds a much stronger record and demonstrates the product stays within acceptable limits throughout its intended life.

Challenge Testing (Preservative Efficacy)

This is the test most brands underestimate. A product that passes microbial limits when it leaves the filling line can still fail to protect a consumer who opens it in a humid bathroom, uses it for months with wet fingers, and stores it at 25°C. USP <51> (Antimicrobial Effectiveness Testing) evaluates whether your preservative system is capable of eliminating deliberate microbial contamination within defined time intervals. The test inoculates your finished formula with specific organisms — Escherichia coli, Staphylococcus aureus, Pseudomonas aeruginosa, Candida albicans, and Aspergillus brasiliensis — at concentrations of approximately 10^5–10^6 CFU/mL and then measures microbial reduction over 28 days.

For cosmetics, the relevant acceptance criteria under USP <51> are Category 2 (for water-miscible products) or Category 3 (for non-aqueous products). A product that fails USP <51> has a deficient preservative system — which, depending on your formula’s water activity and intended use, can represent a genuine consumer safety risk. That failure is not theoretical; it’s exactly the kind of finding FDA considers when evaluating adverse event patterns.

Heavy Metal and Contaminant Screening

Color cosmetics, lip products, mineral-based formulas, and botanical-heavy skincare all carry meaningful risk of elemental contaminants. Lead, arsenic, cadmium, and mercury occur naturally in mineral pigments, clays, and herbal raw materials. FDA has published guidance recommending no more than 10 ppm lead in cosmetics broadly, with a more specific 100 ppm limit historically cited for color cosmetics — and the agency has signaled intent to tighten these thresholds. California’s Proposition 65 adds another layer: the allowable daily intake for lead is 0.5 μg/day, a threshold that translates to extremely low allowable concentrations in leave-on products applied multiple times daily.

ICP-MS (inductively coupled plasma mass spectrometry) is the method of choice — capable of detecting elemental contaminants at the parts-per-trillion level across a full panel of metals in a single run. For brands whose products are available in California — which effectively means most US e-commerce brands — this screen is increasingly non-negotiable.

How to Structure Your Safety Substantiation File

A safety substantiation file isn’t a folder of test reports. It’s a structured, documented argument that your product is safe as intended. The EU Cosmetics Regulation 1223/2009 provides the most detailed template in the world, and while US law doesn’t require that exact format, aligning with it creates a file that will hold up well under any scrutiny.

A complete file for each product should contain:

• Product description and intended use, including the target consumer population — adults, children, consumers with specific skin conditions
• Quantitative formula, with the concentration of each ingredient expressed as percentage by weight
• Ingredient safety profiles, referencing established databases like CIR (Cosmetic Ingredient Review) compendium opinions, SCCS (EU Scientific Committee on Consumer Safety) opinions, or peer-reviewed toxicology literature
• Physical and chemical characterization — pH, viscosity, water activity, stability data covering the claimed shelf life
• Microbiological quality data — USP <61>/<62> results and USP <51> challenge test results
• Contaminant testing results — at minimum, a heavy metals panel for products with relevant risk factors
• Safety assessment conclusion — a synthesized, signed document prepared by a qualified professional (toxicologist, cosmetic safety assessor, or licensed physician) stating that the product is safe for its intended use

That last element is the piece most brands skip entirely. The test reports exist. The safety assessment conclusion — the document that pulls everything together and applies professional judgment — often doesn’t. That conclusion is specifically what FDA’s reviewers and MoCRA enforcement will focus on.

What FDA Enforcement Actually Looks Like Now

MoCRA gave FDA tools it never had before. Mandatory recall authority — previously FDA could only request voluntary cosmetic recalls — is now in place. If FDA determines a cosmetic is adulterated or misbranded, it can order a recall without the brand’s cooperation. The agency has also clarified that facility registration failures, SAER non-compliance, and inability to produce safety records on request are all enforcement priorities in the current cycle.

FDA’s proposed cosmetic GMP rule, which would establish mandatory current Good Manufacturing Practice standards for the first time, is expected to be finalized within the next 12–18 months based on the current regulatory calendar. Draft provisions include requirements around contamination controls, testing programs, and record retention that go meaningfully beyond what most cosmetic brands currently have in place. Compliance deadlines in the proposed rule are tiered by company size — small businesses would get additional time — but even with that extension, building a testing infrastructure retroactively under a deadline is significantly more expensive and disruptive than establishing it as standard practice now.

The brands that come through FDA scrutiny cleanly are, in our experience, the ones that treat safety substantiation as a product development step rather than a post-launch checklist. When your stability data, USP <61>/<62> results, USP <51> challenge test, and contaminant panel are in hand before launch — and your safety assessment conclusion is signed — you’re not scrambling when an inquiry arrives.

Building Your Safety Substantiation File: Start With an Audit

If you’re not certain whether your current documentation would satisfy an FDA review, start by asking these questions for each product in your line:

• Do you have a current COA from a cosmetic testing laboratory with USP <61>/<62> results?
• Has a USP <51> antimicrobial effectiveness test been completed with passing results?
• Do you have accelerated stability data covering the full claimed shelf life?
• Has a heavy metals panel been run on any product containing mineral pigments, clays, or botanical-derived ingredients?
• Is there a written safety assessment conclusion, signed by a qualified reviewer, on file for each product?

Any “no” answer is a priority gap. MoCRA’s requirements aren’t aspirational — they’re current law with active enforcement. Building your file now, on real analytical data, is what puts you in a defensible position. The brands that wait until they receive a request rarely have a good experience after that.

---

Written by Nour Abochama, Vice President of Operations, Qalitex Laboratories. Learn more about our team

Talk to our team about your testing needs. Contact us

Related from our network

• MoCRA Regulatory Strategy and FDA Audit Preparation for Cosmetic Brands — Aurora TIC’s regulatory consultants help cosmetic and personal care brands navigate FDA submissions, GMP gap analyses, and MoCRA compliance programs.
• Raw Material Safety Profiles and Supplier Qualification for Cosmetic Ingredients — Ayah Labs supports safety substantiation with comprehensive ingredient testing, COA verification, and supplier qualification for personal care raw materials.